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DETAILED ACTION 

1 . This is in response to the communications filed on 14 November 2007. 

2. Claims 1, 2, 4, 6, 10, 12, 15, 16, 20, 23, 24, 31, 34, 38, 42, 47, 48, 51, 54-56, 59 and 81-122 
are pending in the application. 

3. Claims 1, 2, 4, 6, 10, 12, 15, 16, 20, 23, 24, 31, 34, 38, 42, 47, 48, 51, 54-56, 59 and 81-122 
have been rejected. 

4. Claims 3, 5, 7-9, 1 1, 13, 14, 17-19, 21, 22, 25-30, 32, 33, 35-37, 39-41, 43-46, 49, 50, 52, 53, 
57, 58 and 60-80 have been cancelled. 

Response to Arguments 

5. Applicant's arguments with respect to claims 1, 2, 4, 6, 10, 12, 15, 16, 20, 23, 24, 31, 34, 38, 
42, 47, 48, 51, 54-56, 59 and 81-122 have been considered but are moot in view of the new 
ground(s) of rejection. 

Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

6. Claims 1, 2, 4, 6, 10, 12, 15, 16, 20, 23, 24, 31, 34, 38, 42, 47, 48, 51, 54-56, 59 and 81-122 
are rejected under 35 U.S.C. 102(e) as being anticipated by Peyravian et al U.S. Patent No. 
6,363,154 Bl. 
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As to claim 1, Peyravian et al discloses a method of establishing a secure communication 
session among a plurality of member nodes that participate in a multicast group across a wide 
area network, comprising the steps of: 

receiving information defining a plurality of multicast proxy service nodes 
[column 5, lines 9-22], wherein: 

the plurality of multicast service nodes are distributed across the 
wide area network [column 5, lines 9-22]; 

the plurality of multicast service nodes control when any of the 
plurality of member nodes join or leave the multicast group [column 5, 
lines 52-63]; and 

the plurality of multicast proxy service nodes are logically 
represented by a first binary tree [column 5, lines 52-63], wherein: 

each node of the first binary tree is associated with a 
domain of a plurality of domains of a directory service that is 
distributed across the wide area network [column 6, lines 13-42]; 
and 

each node of the first binary tree is associated with one or 
more multicast proxy service nodes of the plurality of multicast 
proxy service nodes [column 6, lines 13-42]; 
creating and storing a second binary tree that represents the plurality of 
member nodes [column 6, lines 43-67], wherein: 
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each of the member nodes of the plurality of member nodes is 
represented by a leaf node of the second binary tree [column 6, lines 43- 
67]; 

the second binary tree is stored in a particular domain of the 
plurality of domains of the directory service that is distributed across the 
wide area network [column 6, lines 43-67]; 

a root node of the second binary tree represents one or more of the 
multicast proxy service nodes of the plurality of multicast proxy service 
nodes [column 6, lines 43-67]; and 

each of the member nodes of the plurality of member nodes is 
capable of establishing multicast communication and serving as a key 
distribution center [column 6, lines 43-67]; 

creating and storing a group session key associated with the 
multicast group and a private key associated with each member node of 
the multicast group using secure key exchange [column 6, lines 43-67]; 

when an additional member node joins the multicast group, 
determining a new group session key by replicating a branch of the second 
binary tree [column 6, lines 43-67]. 
As to claims 2, 82 and 103, Peyravian et al discloses that each of the member nodes is 
associated with at least one of the multicast proxy service nodes, wherein each of the multicast 
proxy service nodes acts as one of a plurality of group controllers, further comprising the steps 
of: 
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joining an additional group controller to the plurality of group controllers, 
wherein each group controller of the plurality of group controllers is a replica of 
another group controller of the plurality of group controllers [column 5, lines 44- 
63]; 

establishing, by one of the group controllers, a secure communication 
channel between one of the group controllers and another of the group controllers 
using a key exchange protocol [column 5, lines 44-63]; 

receiving a request to add or delete a specified member node of the 
multicast group from a load balancer that is coupled to the plurality of group 
controllers [column 5, lines 44-63]; 

creating and storing the new group session key for each member node in 
each branch of the second binary tree that is affected by adding or deleting the 
specified member node from the multicast group [column 5, Unes 44-63]; 

distributing the new group session key from one of the group controllers to 
the member nodes that are affected by adding or deleting the specified member 
node [column 5, lines 44-63], 
As to claims 4, 83 and 104, Peyravian et al discloses a method wherein distributing a 
group session key further comprises: 

determining that the specified member node is leaving the multicast group 
[column 5, lines 44-63]; 

determining which of the intermediate nodes of the second binary tree are 
affected by the specified member node that is leaving [column 5, lines 44-63]; 
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updating only keys associated with the intermediate nodes that are affected 
by the specified member node that is leaving [column 5, lines 44-63]; and 

sending the new group session key to the leaf nodes of the second binary 
tree that correspond to the member nodes that are affected by deleting the 
specified member node [column 5, lines 44-63]. 
As to claims 6, 84 and 105, Peyravian et al discloses a method wherein distributing a 
group session key further comprises: 

receiving a request message from the specified member node to join the 
multicast group [column 6, lines 36-54]; 

determining which of the intermediate nodes of the second binary tree are 
affected by the specified member node that is joining the multicast group [column 
6, lines 36-54]; 

updating only keys associated with the intermediate nodes that are affected 
by the specified member node that is joining [column 6, lines 36-54]; 

generating a private key for the specified member node that is joining 
[column 6, lines 36-54]; and 

sending a message comprising the new group session key, the private key, 
and the updated keys of intermediate nodes that are affected to the member node 
that is joining [column 6, lines 36-54]. 
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As to claims 10, 85 and 106, Peyravian et al discloses that determining a new group 
session key further comprises the step of computing a group shared secret key at a first member 
node of the plurality of member nodes for use in a public key process and using less than n * 
(n-1) messages, where "n" is a number of member nodes in the multicast group, by the steps of: 

generating an intermediate shared secret key by issuing communications 
to a second member node of the plurality of member [column 6, lines 36-54]; 

sending a first private value associated with the first member node to the 
second member node, and receiving from the second member node a second 
private value associated with the second member node using the intermediate 
shared secret key [column 6, lines 36-54]; 

generating and communicating a collective public key that is based upon 
the first private value and the second private value to a third member node of the 
plurality of member nodes [column 6, lines 36-54]; 

receiving an individual public key from the third member node [column 6, 
lines 36-54]; and 

computing and storing the group shared secret key based upon the 
individual public key [column 6, lines 36-54]. 
As to claims 12, 86 and 107, Peyravian et al discloses that the step of communicating the 
collective public key fijrther comprises determining whether the first member node or the second 
member node transfers the collective public key based upon an order of entry of the first and 
second member nodes into the multicast group [column 6, lines 43-53]. 
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As to claims 15, 87 and 108, Peyravian et al suggests that computing and storing the 
group shared secret key further comprises the steps of computing and storing a group shared 
secret key value "k" at the first member node according to the relation 

k = C^** mod (q) = p^^^ mod (q) [column 5 line 52 to column 6 line 12] 

wherein: 

C, a, b, c, q, and p are values stored in a memory [column 5 line 52 
to column 6 line 12], 

C is the individual public key [column 5 line 52 to column 6 line 

12], 

a is the first private value of the first member node [column 5 line 
52 to column 6 line 12], 

b is the second private value of the second member node [column 5 
line 52 to column 6 line 12], 

c is a third private value of the third member node [column 5 line 
52 to column 6 line 12], 

p is a base value [column 5 line 52 to column 6 line 12], and 

q is a prime number value [column 5 line 52 to column 6 line 12]. 
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As to claims 16, 88 and 109, Peyravian et al discloses that determining a new group 
session key comprises computing a group shared secret key, each of the member nodes having a 
private key value associated therewith, by the steps of: 

communicating a first public key of a first member node of the plurality of 
member nodes to a second member node of the plurality of member nodes 
[column 6, lines 36-53]; 

creating and storing an initial shared secret key for the first member node 
and the second member node based on a first private key and a second public key 
that is received from the second member node [column 6, lines 36-53]; 

creating and storing information at the first member node that associates 
the first member node with a first entity by generating a collective public key that 
is shared by the first member node and the second member node, wherein the 
collective public key is based on the first private key and a second private key that 
is derived by the first member node from the second public key [column 6, lines 
36-53]; 

receiving a third public key from a third member node of the plurality of 
member nodes that seeks to join the first entity [column 6, lines 36-53]; 

creating and storing a final shared secret key based on the collective public 
key and a third public key [column 6, lines 36-53]; 

joining the first member node to a second entity that includes the first 
entity and the third member node and that uses secure communication with 
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messages that are encrypted using the final shared secret key [column 6, lines 36- 
53]. 

As to claims 20, 89 and 110, Peyravian et al suggests a method further comprising the 
steps of creating and storing a subsequent shared secret key for use by the first entity and the 
third member node to enable the third member node to independently compute the group shared 
key, that creating and storing the subsequent shared secret key further comprises the steps of 
creating and storing a subsequent shared secret key value, k, according to the relation 

k = p(^*>^Xt>*yX^*^) mod (q) [column 5 line 52 to column 6 line 12] 

where: 

p = a random number [column 5 line 52 to column 6 line 12], 
q = a prime number [column 5 line 52 to column 6 line 12], 
a = the first private key [column 5 line 52 to column 6 line 12], 
b = the second private key [column 5 line 52 to column 6 line 12], 
c = a third private key of the third member node [column 5 line 52 

to column 6 line 12], 

X = a number of times the first member node has participated in 

entity formation [column 5 line 52 to column 6 line 12], 

y = a number of times the second member node has participated in 

entity formation [column 5 line 52 to column 6 line 12], and 

z = a number of times the third member node has participated in 

entity formation [column 5 line 52 to column 6 line 12]. 
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As to claims 23, 90 and 111, Peyravian et al suggests that creating and storing the initial 
shared secret key for the first member node and second member node further comprises the steps 
of creating and storing an initial shared public key value "AB" according to the relation 

AB = kab^'' mod (q) = p^^''^^"'') mod (q) [column 5 line 52 to column 6 line 

12] 

wherein k = the initial shared secret key value, a = the first private key 
value, b = the second private key value, p is a base value, and q is a randomly 
generated prime number value [column 5 line 52 to column 6 line 12]. 
As to claims 24, 91 and 112, Peyravian et al discloses a method further comprising the 
steps of: 

authenticating a first multicast proxy service node with a subset of the 
multicast proxy service nodes of the plurality of multicast proxy service nodes 
that are affected by an addition of the first multicast proxy service node to the 
multicast group, based on key information stored in a directory [column 6, lines 
13-53]; 

wherein authenticating the first multicast proxy service node based on key 
information stored in the directory includes authenticating the first multicast 
proxy service node based on the directory that comprises a directory system agent 
(DSA) for communicating with one or more of the multicast proxy service nodes 
and a replication service agent (RS A) for replicating attribute information of one 
or more multicast proxy service nodes, wherein the attribute information 
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comprises the group session key and the private keys of the one or more multicast 
proxy service nodes [column 6, lines 13-53]; 

receiving a plurality of private keys from the subset of multicast proxy 
service nodes [column 6, lines 13-53]; 

generating a new private key for the first multicast proxy service node 
[column 6, lines 13-53]; 

communicating the plurality of private keys and the new private key to the 
first multicast proxy service node [column 6, lines 13-53]; 

communicating a message to the subset of multicast proxy service nodes 
that causes the subset of multicast proxy service nodes to update their private keys 
[column 6, lines 13-53]; 

distributing the new group session key to all multicast proxy service nodes 
of the plurality of multicast proxy service nodes by: 

creating and storing the new group session key using a particular 

multicast proxy service node of a particular domain of the plurality of 

domains of the directory service, wherein the particular domain is 

associated with the directory [colimin 6, lines 13-53]; 

replicating the directory [column 6, lines 13-53]; and 

obtaining the new group session key from a local multicast proxy 

service node that is a replica of the first multicast proxy service node 

[column 6, lines 13-53]. 
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As to claims 31, 92 and 113, Peyravian et al discloses a method further comprising 
selectively updating the group session key and the private keys by: 

detecting whether a member node of the plurality of member nodes that is 
associated with one of the leaf nodes is leaving the multicast group [column 5, 
lines 44-63]; 

determining one or more tree nodes along a tree path in the second binary 
tree that corresponds to the leaving leaf node, wherein the one or more tree nodes 
are affected in response to the detecting step [column 5, lines 44-63]; 

updating the private keys of the one or more tree nodes [column 5, lines 

44-63]; 

one of the affected intermediate nodes that is a parent node of the leaving 
leaf node generating the new group session key and selectively sending the new 
group session key to all ancestral nodes along the tree path [column 5, lines 44- 
63]; 

modifying the key information based upon the updated private keys and 
the new group session key [column 5, lines 44-63]; and 

generating instructions that distribute the modified key information using 
directory repUcation [column 5, lines 44-63]. 
As to claims 34, 93 and 114, Peyravian et al discloses a method further comprising 
selectively updating a group session key and the private keys, wherein the step of selectively 
updating comprises: 



Application/Control Number: Page 14 

09/728,488 

Art Unit: 2131 

receiving a request message from a new member node to join the multicast 
group [column 5, lines 44-63]; 

determining one or more tree nodes along a tree path in the second binary 
tree that corresponds to a new leaf node in the second binary tree for the new 
member node, wherein the one or more nodes are affected in response to the 
receiving step [column 5, lines 44-63]; 

updating the private keys of the one or more tree nodes [column 5, lines 

44-63]; 

one of the affected intermediate nodes that is a parent node of the new leaf 
node requesting permission from a root node of the second binary tree to generate 
the new session key and generating the new group session key and a private key 
of the new leaf node [column 5, lines 44-63]; 

modifying the key information based upon the updated private keys, the 
new group session key, and the private key of the new leaf node [column 5, lines 
44-63]; and 

generating instructions that distribute the modified key information using 
directory replication [column 5, lines 44-63]. 
As to claims 38, 94 and 115, Peyravian et al discloses a method further comprising the 
steps of: 

storing the group session key associated with the multicast group in a 
directory of the directory service [column 6, lines 37-61]; 
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authenticating a first multicast proxy service node with a subset of 
multicast proxy service nodes of the plurality of multicast proxy service nodes 
that are affected by an addition of the first multicast proxy service node to the 
multicast group, based on the group session key stored in the directory [column 6, 
lines 37-61]; 

receiving a plurality of private keys from the subset of multicast proxy 
service nodes [column 6, lines 37-61]; 

receiving the nev^ group session key for the multicast group, for use after 
addition of the first multicast proxy service node, from a directory system agent 
(DSA) of a local multicast proxy service node that has received the new group 
session key through periodic replication of the directory by a replication service 
agent (RSA) of the local multicast proxy service node, wherein the RSA is 
signaled to carry out replication by storing an updated group session key in a local 
node of the director [column 6, lines 37-61]; 

communicating the new group session key to the first multicast proxy 
service node [column 6, lines 37-61]; 

communicating a message to the subset of multicast proxy service nodes 
that causes the subset of multicast proxy service nodes to update their private keys 
[column 6, lines 37-61]. 
As to claims 42, 95 and 116, Peyravian et al discloses a method fiirther comprising the 
steps of: 
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distributing the group session key to all member nodes of the plurality of 
member nodes by creating and storing the group session key using a particular 
multicast proxy service node of the plurality of multicast proxy service nodes, 
wherein the particular multicast proxy service node is associated With a particular 
domain of the plurality of domains, and wherein the particular domain is 
associated with the directory [column 6, lines 37-61]; 

replicating the directory [column 6, lines 37-61]; and 
obtaining the group session key from a local multicast proxy service node 
that is a replica of the particular multicast proxy service node [column 6, lines 37- 
61]. 

As to claim 47, 96 and 117, Peyravian et al discloses a method further comprising the 
steps of: 

associating a plurality of intermediate nodes of the second binary tree with 
a plurality of multicast service agents [column 6, lines 37-61]; 

establishing a secure back channel group among the plurality of multicast 
service agents [column 6, lines 37-61]; 

updating the group session key to all the multicast service agents in the 
plurality of multicast service agents by securely communicating the group session 
key using a secure back channel that is associated with the secure back channel 
group [column 6, lines 37-61]; 
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at each intermediate node of the plurality of intermediate nodes, updating 
the group session key of only those leaf nodes that are child nodes of the each 
intermediate node [column 6, lines 37-61]. 
As to claims 48, 97 and 118, Peyravian et al discloses a method further comprising the 
steps of: 

receiving a request for the group session key from a publisher node that is 
located in a different domain of the plurality of domains from the particular 
domain in which is stored the second binary tree [column 5 line 52 to column 6 
line 12]; 

determining an identifier of the publisher node using a first directory 
service agent that is associated with a particular muhicast proxy service node of 
the plurality of multicast proxy service nodes, wherein the particular multicast 
proxy service node is in the particular domain [column 5 line 52 to column 6 line 

12]; 

establishing a secure communication channel among the particular 
multicast proxy service node and a directory service agent that is associated with 
a different multicast proxy service node of the plurality of multicast proxy service 
nodes, wherein the different multicast proxy service node is in the different 
domain [column 5 line 52 to column 6 line 12]. 
As to claims 51, 98 and 119, Peyravian et al discloses a method further comprising the 
step of managing removal of a first member node from the multicast group, wherein managing 
removal of the first member node further comprises the steps of: 
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creating and storing the group session key associated with the multicast 
group and a private key associated with each member node of the plurality of 
member nodes in a directory [column 5, lines 23-43]; 

receiving information indicating that the first member node is leaving the 
multicast group [column 5, lines 23-43]; 

updating all affected keys of a subset of member nodes of the plurality of 
member nodes in a branch of the second binary tree that contains the first member 
node that is leaving [column 5, lines 23-43]; 

receiving the new group session key for the multicast group, for use after 
removal of the first member node, and a new private key for a parent node of the 
first member node, from a local multicast proxy service node of the plurality of 
multicast proxy service nodes [column 5, lines 23-43]; 

. communicating a message to the subset of member nodes that causes the 
subset of member nodes to update their private keys [column 5, lines 23-43]. 
As to claims 54, 99 and 120, Peyravian et al discloses a method fiarther comprising the 
steps of: 

associating a plurality of intermediate nodes of the second binary tree with 
a plurality of multicast service agents [column 5, lines 23-43]; 

establishing a secure back channel group among the plurality of multicast 
service agents [column 5, lines 23-43]; 

updating the group session key to all the multicast service agents in the 
plurality of multicast service agents by securely communicating the group session 
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key using a secure back channel that is associated with the secure back channel 
group [column 5, lines 23-43]; 

at each intermediate node of the plurality of intermediate nodes, updating 
the group session key of only those leaf nodes that are child nodes of the each 
intermediate node [column 5, lines 23-43]. 
As to claims 55, 100 and 121, Peyravian et al discloses a method further comprising the 
steps of: 

receiving a request for the group session key from a publisher node that is 
located in a different domain of the plurality of domains from the particular 
domain in which is stored the second binary tree [column 8, lines 3-19]; 

determining an identifier of the pubUsher node using a first directory 
service agent that is associated with a particular multicast proxy service node of 
the plurality of multicast proxy service nodes, wherein the particular multicast 
proxy service node is in the particular domain [column 8, lines 3-19]; 

establishing a secure communication channel among the particular 
muhicast proxy service node and a directory service agent that is associated with 
a different multicast proxy service node of the plurality of multicast proxy service 
nodes, wherein the different multicast proxy service node is in the different 
domain [column 8, lines 3-19]. 
As to claims 56, 101, and 122, Peyravian et al discloses a method further comprising the 
steps of: 
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distributing the group session key to all member nodes of the plurality of 
member nodes by creating and storing the group session key using a particular 
multicast proxy service node of the plurality of multicast proxy service nodes, 
wherein the particular multicast proxy service node is associated with a particular 
domain of the plurality of domains, and wherein the particular domain is 
associated with the directory [column 7, lines 23-42]; 

replicating the directory [column 7, lines 23-42]; and 
obtaining the group session key from a local multicast proxy service node 
that is a replica of the particular multicast proxy service node [column 7, lines 23- 
42]. 

As to claims 59, 81 and 102, Peyravian et al discloses a computer-readable medium 
carrying one or more sequences of instructions for establishing a secure communication session 
among a plurality of member nodes that participate in a multicast group across a wide area 
network, wherein execution of the one or more sequences of instructions by one or more 
processors causes the one or more processors to perform the steps of: 

receiving information defining a plurality of multicast proxy service nodes 
[column 5, lines 9-22], wherein: 

the plurality of multicast service nodes are distributed across the 
wide area network [column 5, lines 9-22]; 

the plurality of multicast service nodes control when any of the 
plurality of member nodes join or leave the multicast group [column 5, 
lines 52-63]; and 
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the plurality of multicast proxy service nodes are logically 
represented by a first binary tree [column 5, lines 52-63], wherein: 

each node of the first binary tree is associated with a 
domain of a plurality of domains of a directory service that is 
distributed across the wide area network [column 5, lines 52-63]; 
and 

each node of the first binary tree is associated with one or 
more multicast proxy service nodes of the plurality of multicast 
proxy service nodes [column 6, lines 13-36]; 
creating and storing a second binary tree that represents the plurality of 
member nodes [column 6, lines 13-36], wherein: 

each of the member nodes of the plurality of member nodes is 
represented by a leaf node of the second binary tree [column 6, lines 37- 
61]; 

the second binary tree is stored in a particular domain of the 
plurality of domains of the directory service that is distributed across the 
wide area network [column 6, lines 37-61]; 

a root node of the second binary tree represents one or more of the 
multicast proxy service nodes of the plurality of multicast proxy service 
nodes [column 6, lines 37-61]; and 
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each of the member nodes of the plurality of member nodes is 
capable of establishing multicast communication and serving as a key 
distribution center [column 6, lines 37-61]; 

creating and storing a group session key associated with the multicast 
group and a private key associated v^ith each member node of the multicast group 
using secure key exchange [column 6, lines 37-61]; 

when an additional member node joins the multicast group, determining a 
new group session key by replicating a branch of the second binary tree [column 
6, lines 37-61]. 

Conclusion 

7. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Aravind K. Moorthy whose telephone number is 571-272-3793. 
The examiner can normally be reached on Monday-Friday, 8:00-5:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R. Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for impublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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